# Cross Origin Isolation

> Cross Origin Isolation is an Agent Skill for devops & security published in the thedaviddias/Front-End-Checklist repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Use when reviewing security-sensitive web apps, SharedArrayBuffer usage, worker-heavy apps, editors, or measurement features that require cross-origin isolation. Check both headers and real browser behavior.

- Skill name: `cross-origin-isolation`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/thedaviddias/Front-End-Checklist/blob/HEAD/skills/cross-origin-isolation/SKILL.md
- Repository: thedaviddias/Front-End-Checklist (73,218 GitHub stars when collected)

## SKILL.md

# Use COOP, COEP, and CORP for cross-origin isolation when needed

Cross-origin isolation reduces opener-based attacks and XS-Leak risk, and it is required for powerful browser features such as SharedArrayBuffer in modern browsers. It also breaks integrations if deployed carelessly, so it needs a deliberate rollout rather than a copy-pasted header block.

## Quick Reference

- Use `Cross-Origin-Opener-Policy` and `Cross-Origin-Embedder-Policy` together when you need cross-origin isolation
- Audit every cross-origin script, iframe, image, worker, and font before enforcing COEP
- Serve embeddable resources with CORS or `Cross-Origin-Resource-Policy` as appropriate
- Verify `self.crossOriginIsolated === true` before depending on isolated-only features

## Check

Review security headers and embedded resources for cross-origin isolation. Check whether the app needs COOP/COEP, whether resources are compatible with COEP, and whether the runtime actually becomes crossOriginIsolated.

## Fix

Add COOP and COEP only after auditing dependencies, ensure subresources use CORP or CORS as required, and verify the final document becomes crossOriginIsolated in the browser.

## Explain

Explain how COOP, COEP, and CORP work together, what they protect against, and why third-party embeds often block a successful rollout.

## Code Review

Review server headers, third-party integrations, popups, workers, and asset responses related to Use COOP, COEP, and CORP for cross-origin isolation when needed. Flag exact responses or integrations that would block isolation or break once isolation is enforced.

---

For full implementation details, code examples, and framework-specific guidance,
see `references/rule.md`.

Rule page: https://frontendchecklist.io/en/rules/security/cross-origin-isolation

---

Source: https://www.openparable.com/skill/devops-security/cross-origin-isolation (OpenParable). Cite the canonical URL above.